ROSE: prevent heap corruption with bad facilities

[platform/adaptation/renesas_rcar/renesas_kernel.git] / net / rose / rose_subr.c

diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
index 1734abb..174d51c 100644 (file)
--- a/net/rose/rose_subr.c
+++ b/net/rose/rose_subr.c
@@ -290,10 +290,15 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
                                facilities->source_ndigis = 0;
                                facilities->dest_ndigis   = 0;
                                for (pt = p + 2, lg = 0 ; lg < l ; pt += AX25_ADDR_LEN, lg += AX25_ADDR_LEN) {
-                                       if (pt[6] & AX25_HBIT)
+                                       if (pt[6] & AX25_HBIT) {
+                                               if (facilities->dest_ndigis >= ROSE_MAX_DIGIS)
+                                                       return -1;
                                                memcpy(&facilities->dest_digis[facilities->dest_ndigis++], pt, AX25_ADDR_LEN);
-                                       else
+                                       } else {
+                                               if (facilities->source_ndigis >= ROSE_MAX_DIGIS)
+                                                       return -1;
                                                memcpy(&facilities->source_digis[facilities->source_ndigis++], pt, AX25_ADDR_LEN);
+                                       }
                                }
                        }
                        p   += l + 2;
@@ -333,6 +338,11 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
 
                case 0xC0:
                        l = p[1];
+
+                       /* Prevent overflows*/
+                       if (l < 10 || l > 20)
+                               return -1;
+
                        if (*p == FAC_CCITT_DEST_NSAP) {
                                memcpy(&facilities->source_addr, p + 7, ROSE_ADDR_LEN);
                                memcpy(callsign, p + 12,   l - 10);
@@ -373,12 +383,16 @@ int rose_parse_facilities(unsigned char *p,
                        switch (*p) {
                        case FAC_NATIONAL:              /* National */
                                len = rose_parse_national(p + 1, facilities, facilities_len - 1);
+                               if (len < 0)
+                                       return 0;
                                facilities_len -= len + 1;
                                p += len + 1;
                                break;
 
                        case FAC_CCITT:         /* CCITT */
                                len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
+                               if (len < 0)
+                                       return 0;
                                facilities_len -= len + 1;
                                p += len + 1;
                                break;